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1 Introduction. 

Let E be an elliptic curve over Q. By the Mordell-Weil theorem, the group 
E(Q) of rational points on E is a finitely generated abelian group. Hence, it is 
the product of the torsion group and r > copies of an infinite cyclic group: 
E(Q) = -E(Q)tors x Z r . By Mazur's theorem, we know that E(Q) toTS is one of 
the following 15 groups: Z/nZ with 1 < n < 10 or n = 12, Z/2Z x Z/2mZ with 
1 < m < 4. 

It is well-known that elliptic curves have applications in cryptography and 
also in factorization of large integers and primality proving. The main idea is 
to replace the group F* with (fixed) order p — 1, by the group E(¥ p ) with more 
flexible order. Namely, by the Hasse theorem we have 

p + l-2^p<\E(¥ p )\<p+l + 2^p. 

In particular, elliptic curves with large torsion and positive rank (it is nec- 
essary for an elliptic curve to have positive rank for it to be used for factor- 
ization) over the rationals have long been used for factorization, starting with 
Montgomery, Atkin and Morain ( [TUl H] ) ■ We say that an integer m is n-smooth, 
for some fixed value n if all the prime divisors of m are less or equal than n. 
Choosing elliptic curves E for the elliptic curve factoring method (ECM), one 
wants to choose elliptic curves such that the order E(¥ p ) is smooth (for more 
details about ECM, see [5], where the method was introduced). 
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Standard heuristics say that larger torsion of E(Q) implies a greater prob- 
ability that |Z?(F p )| is smooth. This is because the torsion of E(Q) will inject 
into E(¥ p ) for all primes p of good reduction, making |_E(F P )| divisible by the 
order of the torsion of E(Q). But this is not necessary so straightforward, as 
shown in [2], as a curve with smaller E(Q)t OTS can have much larger torsion over 
fields of small degree, giving all together a greater probability of |_E(F p )| to be 
smooth. 

As we shown in Section [5] of this paper, this is especially true in some in- 
stances, when for some reasons the properties of the prime factors of the num- 
bers that are to be factored are known. One can then do better by choosing 
elliptic curves with large torsion and positive rank over some small extension of 
Q. Nice explicit examples of this approach, for factoring large numbers (Cun- 
ningham numbers in this case) by using elliptic curves over number fields, have 
been provided recently by Brier and Clavier [3J. They used elliptic curves over 
cyclotomic fields with torsion groups Z/3Z © Z/6Z and Z/4Z © Z/4Z. 

Also, they tried to construct elliptic curves over cyclotomic fields with torsion 
Z/5ZffiZ/5Z and Z/4Z0Z/8Z and positive rank, but failed. Recently, examples 
of such curves have been found in [2] . In this paper we show how to construct 
such curves systematically in Section SJ 

It is very useful to have families of curves suitable for use in ECM, as when 
one curve fails to yield a factorization, another one can be used. For the largest 
torsions from Mazur's theorem, families of elliptic curves with large torsion and 
positive rank can be found in [1]. Each of these is a parameterized family of 
elliptic curves, in other words there exists a surjective map from P 1 (Q) (minus 
some points) to this family of elliptic curves. This can also be understood as a 
map from a genus curve to the family of elliptic curves. 

This is the best possible case, but for some torsion groups, such maps are 
yet unknown, and in most cases theoretically impossible. In these cases we 
can instead construct a map from some curve of positive genus to the family 
of elliptic curves with large torsion and positive rank. An example of such a 
map was constructed in [3J, where elliptic curves with torsion Z/3Z0 Z/6Z and 
positive rank were parameterized by an elliptic curve of positive rank. Note 
that it is preferable for the genus of the curve to be as small as possible. In 
particular if we have a map from an elliptic curve with positive rank, this again 
allows us to construct infinitely many curves in such a manner. In Section [3] we 
construct 2 new examples of families of elliptic curves with positive rank and 
torsion isomorphic to Z/3Z® Z/6Z over Q(y/—o), that are each parameterized 
by an elliptic curve of positive rank. We also construct a family of elliptic curves 
with torsion Z/5Z© Z/5Z and positive rank over Q(Cs) that is parameterized 
by a genus 2 curve. 

Families of elliptic curves with high rank and prescribed torsion over the ra- 
tionals have been of great interest historically (see [5] for a list of references). In 
recent years there has been also a great interest for such families over quadratic 
fields [TTJ [Si [6] . In Section [3] we also construct a parameterized family of elliptic 
curves with torsion Z/3Z Z/3Z and rank 2, which was previously unknown. 
The benefit of using rank 2 curves instead of rank 1 curves for ECM might be 
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in the case when the reduction of one generator is not of smooth order. With a 
rank 2 curve one can hope that the other generator might reduce to a point of 
smooth order, although the probability for this is not very high, and thus the 
algorithmical benefits of rank 2 are not clear at the moment. 

When we have a map from a curve of genus > 1, then we can in this way 
always construct only finitely many curves with the desired property. In these 
cases it is actually more useful to have a procedure to construct such curves. In 
Section @] we give a procedure that constructs elliptic curves with torsion groups 
Z/4Z ffi Z/8Z, Z/5Z © Z/5Z and Z/6Z © Z/6Z and positive rank over quartic 
fields. We also give some examples of curves constructed in this way. 

2 Choosing curves for ECM depending on the 
primes 

In this section, we show how the chance for an elliptic curve E over Q to be 
smooth over F p really depends on the set of primes that p runs through. The 
ideas presented here expand on the arguments outlined in [2] . We will show that 
knowing the splitting behavior of the primes in some extension of Q over which 
E has large torsion can be used to determine how likely E is to be smooth. 

Let E be an elliptic curve with torsion T\ over Q and T-i over some number 
field K of relatively small degree and suppose |Ti| < |T 2 |. Suppose for simplicity 
that K is Galois (one could make the same argument with non-Galois extensions, 
but it would be a bit more messy). Then one can see if the rational prime p 
splits completely in K, then the whole torsion of E(K) will inject into E(F p ) 
(see [TH Proposition 3.1, pp. 176]). Thus we expect E(¥ p ) to be smooth more 
often when p runs through the primes that split completely in K than over the 
set of all primes. 

We test this heuristic by choosing the following 8 elliptic curves: 

E : y 2 = x 3 + 3, 

E 7 :y 2 - 55xy - 448y = x 3 - 448a: 2 , 

E 9 :y 2 ~ 47 xy - 624y = x 3 - 624a; 2 , 

E12 : y 2 + 19/40xj/ - 273/400?; = a: 3 - 273/400x 2 , 

£2x8 : V 2 = x 3 + 54721/225a; 2 + 4096a:, 

#4x8 :y 2 +xy + y = x 3 + x 2 - 52431a - 2731947, 

#5x5 : V 2 + V = x 3 + x 2 - 5092900a + 709824595630, 

^6x6 : y 2 + xy + y = x 3 - 371066a; - 47384980. 

The curves were chosen in the following way: Eq, £7, Eg and En have trivial 
torsion, 7-torsion, 9-torsion and 12-torsion over Q, respectively. The curve £2x8 
has torsion Z/2Z©Z/8Z over Q. The curves E4 X& ,E 5x5 and E ex& were chosen 
such that they have torsions Z/4Z©Z/8Z, Z/5Z©Z/5Z and Z/6Z©Z/6Z over 
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some biquadratic field. Note that E 4x $ has torsion Z/2Z© Z/2Z over Q, E 5x5 
has 5-torison over Q and E 6x6 has 6-torsion over Q. All the listed elliptic curves 
have rank 1 over Q, so the rank should not influence the smoothness results. 
The curve £?5x5 is taken from [2]. Note that new curves with the same property 
will be constructed in Section [3] and 

We now test how often the reductions of these curves |-E(F p ))| have 100- 
smooth order, depending on the set of primes that we choose. We will test 
subsets of the set {p„|50 < n < 10050}, where p n denotes the n-th prime (we 
choose n > 50 to get rid of the primes of bad reduction) . Let 

A = {p n \50 <n< 10050}, 
143 



B = { P e A\ 



P 



= 1}, 



C = {peA\(-^)=-i} t 



D = {p e A\p = 1 (mod 5)}, 
E = {peA\ f^j = 1 and 

F = {p e A\ = 1 and (zL 



1}, 
!}• 



The elliptic curve E 12 has torsion Z/2ZffiZ/12Z over Q(V=143), and Z/12Z 
over all other quadratic fields, so we expect this curve to be more likely smooth 
over F p , where p splits in 



-143), then when p does not split. We compare 
this by examining the reductions over the primes from the sets B and C. The 
curve E§ X 5 has torsion Z/5Z© Z/5Z over Q(Cs). Recall that a rational prime 
p splits completely in Q(Cs) if and only if p = 1 (mod 5). Thus we expect 
|-E'5x5(Fp)| to be more likely smooth when p = 1 (mod 5). The curves £4x8 and 
E 6x6 have torsions Z/4Z©Z/8Z, and Z/6Z©Z/6Z over the fields QiV 11 !, V 11 !) 
and Q(\/— 3, y/217), so the sets E and F have been chosen in a way such that 
we expect |-E4xs(F p )| and |i?6x6(Fp)|, respectively, to have a greater probability 
to be smooth. 

In the table below we list for each set S and each curve E the number of 
100-smooth values of |-E(F p )|, where p e S. 



el. curve 


A 


B 


C 


D 


E 


F 


E 


2822 


1453 


1369 


643 


522 


633 


E 7 


4275 


2115 


2160 


1020 


1014 


1066 


Eg 


4635 


2306 


2329 


1110 


1226 


1125 


E12 


5133 


2852 


2281 


1290 


1302 


1288 


E2X8 


5110 


2587 


2523 


1245 


1206 


1295 


£■4x8 


4317 


2141 


2176 


1059 


1098 


1440 


£"5x5 


4376 


2137 


2239 


1448 


1047 


1074 


£■6x6 


4817 


2396 


2421 


1201 


1505 


1138 
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We see that when we run through all primes (the set A), then the curves 
most likely to be smooth are £12 and £2x81 with them approximately being 
equally likely to be smooth. In the columns with the sets B and C we see that 
£12 is approximately 10% more likely to be smooth than £"2x8 when reducing 
modulo the primes from B, and more than 10% less likely to be smooth when 
reducing modulo the primes from C. We also see that the curves £4x8 ,£5x5 
and Eq x q are most likely to be smooth when reducing modulo the primes from 
D, E and F, respectively, outperforming all the other curves quite convincingly 
in each case. 

These result strongly suggest that, when performing ECM, if one knows the 
splitting behavior of the primes over which the curves are going to be reduced, 
one can in some cases do considerably better than just choosing elliptic curves 
with the largest possible torsion over Q. 

3 A method for finding subfamilies with larger 
rank. 

In this section we will describe a method for construction of families of elliptic 
curves with certain property and relative large rank. We assume that a family 
of elliptic curves with that property is known, and we show how to find its 
subfamily with larger generic rank. 

Let K be a number field, E : y 2 — f(x) an elliptic curve over K(T) and 
let A be its discriminant. Assume that E has a nontrivial torsion group. We 
seek congruences of the shape x = x$ (mod 8), where 8 is a factor of A, which 
are satisfied by ^-coordinates of some of the torsion points (and other known 
points on E(K(T)) in the case of curves with positive generic rank and known 
points of infinite order). Then we search for further (nontorsion) points on E 
with x-coordinate of the form x — xq + Sp, where p is a polynomial over K with 
small degree (say degp < 2). We insert x = x + 5(aT 2 + bT + c) into /(x), 
get rid of the quadratic factor, and impose the condition that the discriminant 
of the remaining polynomial in T is 0. This gives us several equations for 
a, 6, a Substituting the obtained conditions, we repeat the procedure (getting 
rid of quadratic factors and asking that the remaining polynomial in T has zero 
discriminant). Finally, we get a condition of the form g(T) — z 2 . If the condition 
corresponds to a curve of genus or 1 with a K-rational point, then we obtain 
a subfamily for E with potentially larger rank. That the rank indeed increases, 
can be checked by finding a suitable specialization for which the corresponding 
points are independent. 

A variant of this procedure has been previously successfully used for finding 
generators of some high rank elliptic curves over Q with relatively large torsion 
group which can be found in [4] . A motivation for this methods comes from the 
Lutz-Nagell theorem which says that the torsion points, but possibly also some 
other integer points, satisfy y = (mod 8) for a factor 8 of A. But this implies 
x = xq (mod 8) for xq from a finite set. 
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We will illustrate the above method by constructing the first known example 
of an elliptic over Q(y/—3)(T) with torsion group Z/3Z©Z/3Z and rank > 2. We 
will also apply variants of this method to curves with torsion groups Z/3Z©Z/6Z 
and Z/5Z © Z/5Z, and we will obtain results comparable to those from [3] and 



Z/3Z© Z/3Z 

Our starting point is the curve over Q(v— 3)(T) with torsion group Z/3Z© 
Z/3Z and rank > 1 found by Rabarison [llj : 

Y 2 = X 3 + (108 + T 6 )X 2 + (144T 6 + 3888)X + 64T 1 2 + 3456T 6 + 46656. 

Its discriminant is A = -4096T 12 (T 2 + 3) 3 (T 2 + 3T + 3) 3 (T 2 - 3T + 3) 3 . The 
torsion points over Q(T) are O, (-4T 4 + 12T 2 - 36, -AT 7 + 12T 5 - 36T 3 ), 
(-4T 4 + 12T 2 - 36, AT 7 - 12T 5 + 36T 3 ) (with an additional point (4/3T 6 - 
36,4^/^~3/9T 9 + I2y/~HT 3 ) of order 3 over Q(y/=3)(T)). It has positive rank, 
with the point (0, 8T 6 + 216) of infinite order. 

Applying the above procedure to the points with the first coordinate of the 
form X = (aT + b)(T 2 + 3T + 3), leads to X = (12T - 12)(T 2 + 3T + 3) 
and the condition 13T 2 - 42T + 93 = z 2 , which is a genus curve with the 
parametrization 

_ u 2 - 16u- 29 
u 2 - 13 

By taking u = 1, we get the curve 

Y 2 = X 3 + 1850293/729X 2 + 28659904/81X + 205347524322304/531441 

and the independent points of infinite order (0, 14329952/729) and (7904/9, 
42080896/729). Hence, we have constructed a curve over Q(u) with rank > 2 
and with torsion group over Q(\/— 3) (it) isomorphic to Z/3Z0Z/3Z. Explicitly, 
the curve is 

y 2 = x 3 + (1116118693 + 2352294282m 2 + 508999635m 4 - 26095764m 6 + 823995m 8 

- 4758m 10 + 109m 12 + 1969070304m + 1658452000m 3 - 818496m 5 + 28224m 7 - 68000m 9 

- 96M n )a; 2 + 576(7m 2 + 32m + 37)(m 2 - 16m + 67)(m 4 - 8m 3 + 30m 2 + 232m + 337) 
X (m 4 + 16m 3 + 246m 2 + 304m + 217)(m 2 - 13) 6 a; 

+ 1024(7m 2 + 32m + 37) 2 (m 2 - 16m + 67) 2 (m 4 - 8m 3 + 30m 2 + 232m + 337) 2 
x (m 4 + 16m 3 + 246m 2 + 304m + 217) 2 (m 2 - 13) 6 , 

with independent points of infinite order 

Pi = (0,32(7w 2 + 32u + 37)(u 2 - 16u + 67)(u 4 - 8m 3 + 30w 2 + 232w + 337) 
x (u 4 + 16u 3 + 246m 2 + 304u + 217)(u 2 - 13) 3 ), 

P 2 = (-192(u+l)(7u 2 + 32u + 37)(u 2 -16w + 67)(w 2 -13) 3 ,32 

(7m 2 + 32u + 37)(u 2 - 16m + 67)(u 2 + 2u + 13)(w 2 - 16u - 29) 3 (u 2 - 13) 3 ). 
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Z/3Z© Z/6Z 

Since in this case we have a point of order 2, we can write the curve in the 
form y 2 = x 3 + ax 2 + bx, and we get the general form of curves with torsion 
group Z/3Z © Z/6Z over Q(y/=3) by taking A = -24(3T 2 - 4)(9T 4 - 36T 3 + 
72T 2 - 48T + 16), B = 144(T - 2) 3 (3T - 2) 3 (3T 2 + 4) 3 (see [TTJ [8]). The 
discriminant is A = 97844723712T 3 (3T 2 - 6T + 4) 3 (T - 2) 6 (3T- 2) 6 (3T 2 + 4) 6 . 
We search for points on the curve such that their ^-coordinate is a factor b\ 
of B. (A similar method was used in [SJ for finding a curve over Q(i)(T) with 
torsion group Z/4Z © Z/4Z and rank > 2). This leads to the condition that 
6i + A + Bjb\ is a perfect square. Several such factors lead to the condition 
which correspond to curve of genus 1. E.g. 

(i) for h = -12(T - 2) 3 (3T 2 + 4)(3T - 2) we get the genus 1 curve -27T 4 + 
72T 3 — 144T 2 + 96T = z 2 with rank 1 (the minimal Weierstrass equation 
is Y 2 + Y = X 3 - 34); 

(ii) for 6i = 3/2(T-2) 2 (3T 2 + 4) 2 (3T-2) 3 we get the genus 1 curve 162T 3 - 
324T 2 + 216T— 1200 = z 2 with rank 2 (the minimal Weierstrass equation 
is Y 2 = X 3 - 648); 

(iii) for bi = 4(T - 2)(3T 2 + 4)(3T - 2) 3 we get -6T 3 + 12T 2 - 8T + 4 = z 2 
with rank 1 (the minimal Weierstrass equation is Y 2 + Y = X 3 + 1). 

The example (i) is equivalent to the example given in [3], while the examples 
(ii) and (iii) give new examples of infinite families of curves over Q(v— 3) with 
torsion group Z/3Z© Z/6Z and positive rank. 

Z/5Z© Z/5Z 

The curve y 2 = x 3 + Ax + B, where A = -27(T 20 + 228T 15 + 494T 10 - 
228T 5 + 1), B = 54(r 30 - 522T 25 -100 05T 20 -100 05T 10 + 522T 5 + l) has torsion 
group Z/5ZffiZ/5Z over cyclotomic field Q(Cs) (see Its discriminant is A = 
2176782336T 5 (T 2 -T-l) 5 (T 4 -2T 3 + 4T 2 -3T+l) b (T 4 + 3T 3 + 4T 2 + 2T+l) 5 . 
The x-coordinates of the torsion points over Q(T), 3T 10 + 36T 9 + 72T 8 + 108T 7 + 
180T 6 + 90T 5 + 72T 4 - 36T 3 + 36T 2 + 3 and 3T 10 + 36T 8 + 36T 7 + 72T 6 - 
90T 5 + 180T 4 - 108T 3 + 72T 2 - 36T + 3, satisfy the congruence 

x = 33T(T 2 -T + l)(T 5 + 2T 4 + 3T 3 -T 2 + T-l) + 3 

(mod T(T 4 - 2T 3 + 4T 2 - 3T + 1)(T 4 + 3T 3 + 4T 2 + 2T + 1)). 

Searching for nontorsion points of the form x = (aT 2 + bT + c) (T 4 — 2T 3 + 4T 2 — 
3T+l)(T 4 +3T 3 +4T 2 +2T+l)+33T(T 2 -T+l)(T 5 +2T 4 +3T 3 -T 2 +T-l)+3, 
we were not able to reach the condition leading to curves of genus or 1. 
However, by taking aT 2 + bT + c = —QT 2 + QT — 27, we obtain the condition 
T 5 — 18 = z 2 which gives a curve of genus 2. By taking T — 3, we get the curve 

y 2 +y = x 3 + x 2 - 226248a; - 20170186 

with rank 1 and torsion Z/5Z © Z/5Z. The point (-132,2722) is of infinite 
order. 
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4 Constructing individual curves with torsion 

Z/4Z Z/8Z, Z/5Z Z/5Z and Z/6Z Z/6Z 

As mentioned in the introduction, we often cannot construct a surjective map 
from a curve of genus < 1 to a family of elliptic curves over Q with prescribed 
torsion and positive rank. This is exactly the case for the torsions Z/4Z©Z/8Z, 
Z/5Z © Z/5Z and Z/6Z © Z/6Z, which are interesting for ECM, as shown in 
Section [2] 

Curves with torsion Z/6ZffiZ/6Z over a biquadratic field are the easiest case 
and we deal with them first. In fact one can use the elliptic curves over Q(\/— 3) 
obtained in Section |3l and then for each curve construct an elliptic curve with 
torsion Z/6Z Z/6Z over the quadratic extension of Q(\/— 3) obtained by ad- 
joining the root of the discriminant of the elliptic curve. Each curve constructed 
in this way have rank at least 2. 

We are left with the torsion groups Z/4Z® Z/8Z and Z/5Z0Z/5Z. We give 
a method of constructing curves with these torsion groups and positive rank. In 
theory, this can give us infinitely many elliptic curves with the desired torsion 
and positive rank. This method is also very useful for practical purposes, easily 
generating many curves with the desired properties. 

The starting point is [7 , where a method of constructing infinitely many 
elliptic curves with the before-mentioned torsion groups is given. We then sieve 
through the constructed curves in search of elliptic curves with positive rank. 
We do not test directly whether the curve has positive rank but instead use 
the fact that in this construction, for all three torsion groups, all the obtained 
elliptic curves are rational, and that the torsion group we desire is defined over 
a biquadratic field. 

We then use the fact that if K is a number field, L a quadratic extension of 
K, L = K{\fd), and E an elliptic curve defined over K, then 

xank{E{L)) = v&nk(E(K)) + rank(£ (d )(if)). 

As we are interested in the rank of a rational elliptic curve E over a biquadratic 
field K, one can see that the rank of E(K) is the sum of the rank of the E(Q) 
and 3 of its twists. 

To construct elliptic curves with torsion Z/4Z© Z/8Z, we do the following: 

1. Construct a rational elliptic curve with torsion Z/4Z© Z/8Z over a bi- 
quadratic field using the methods from [7J. We start by taking t e Q*. 
Define v = (t A - U 2 + l)/(4(£ 2 + l) 2 . Let L be obtained by adjoining the 
root of t A - U 2 + 1 to Q(i) and let a = v 2 - 1/16. Let E be the elliptic 
curve defined by 

E : y 2 + xy — ay = x 3 — ax 2 . 

2. Check whether any of the twists of E by — 1, t 4 — 6t 2 + 1 and — (i 4 — 
6t 2 + 1) have root number -1. If they do, then the Birch-Swinnerton-Dyer 
conjecture suggest that the rank is odd and hence positive. 
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3. If any of the twists have root number -1, then search for points of infinite 
order on it. If none of the twists have root number -1, choose another t 
and start over. 

4. If a point of infinite order is found then we have found an elliptic curve 
with the desired properties! Note that it does not matter which twist we 
choose, as they are all isomorphic over L. If a point of infinite order is 
not found on any twist with odd root number, choose another t and start 
over. 

Using this procedure we can easily construct many elliptic curves with torsion 
Z/4Z©Z/8Z and positive rank over a biquadratic field. For example, the value 
t = 4 gives us the elliptic curve 

y 2 + xy + 3600/83521y = x 3 + 3600/83521x 2 

with a point of infinite order (-30/289,3900/83521) and torsion Z/4Z © Z/8Z 
over Q(i, \/l61). 

The value t = 3 gives the curve 

y 2 = x 3 - 67950603/390625x126442451898/244140625 

which has a point of infinite order (-3549/625, 10584/625) and torsion Z/4Z© 
Z/8Z over Q(i, v 7 ^). 

In a only slightly different way one can construct elliptic curves with torsion 
Z/5Z© Z/5Z over Q(Cs)- We will not write the formulas explicitly as above, as 
one can find them in [7]. 

Here the only difference is that as Q(Cs) is not a biquadratic, but an extension 
with Galois group Z/4Z, one cannot look at 3 rational twists of the constructed 
elliptic curve E, but only at the twist by 5 (as Q(y/E) is a subficld of Q(C5))- 
Thus we look at only 2, instead of 4 curves for root number -1. 

Nevertheless, we are able to easily construct the curves 

y 2 = x 3 - 10605390625/104603532032;- 4238740478515625/22236242266222092 

with a point of infinite order (-9875/177147, 75625/3188646) and torsion Z/5Z© 
Z/5Z over Q(£ 5 ) and 

y 2 = x 3 + 147734375/50331648a; + 1010986328125/927712935936 

with the point of infinite order (15625/12288, 171875/65536) and torsion Z/5Z© 
Z/5Z over Q(Cs)- These curves were obtained by inserting the values t = 1/3 
and t = —1/2, respectively in the formulas in [7]. 
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